Tinycontrol tcPDU and LAN Controllers bypass authentication
Two authentication bypass vulnerabilities in Tinycontrol tcPDU and LAN Controllers allow credential theft; patches available in firmware versions 1.36-1.75.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities affecting Tinycontrol devices including tcPDU and LAN Controllers (LK3.5, LK3.9, LK4). CVE-2025-11500 exposes a critical authentication bypass where usernames and encoded passwords are leaked in JSON responses when visiting the login page, due to a separate authentication mechanism for interface management that defaults to off. This allows unauthenticated attackers on the local network to obtain both normal and admin credentials. CVE-2025-15587 is a privilege escalation issue allowing low-privileged users to read administrator passwords by directly accessing specific resources not available through the graphical interface.
Both vulnerabilities have been patched in recent firmware releases: version 1.36 for tcPDU, version 1.67 for LK3.5 (hardware 3.5-3.8), version 1.75 for LK3.9 (hardware 3.9), and version 1.38 for LK4 (hardware 4.0). Organizations using these devices should immediately upgrade to the patched firmware versions. CVE-2025-11500 was reported by Paweł Różański from Securitum, while CVE-2025-15587 was reported by the vendor itself.
These vulnerabilities pose significant risk to organizations using Tinycontrol devices for power distribution and LAN control, as they could allow attackers to gain administrative access to critical infrastructure components.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-11500
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs